[2.880][BUG]ASG not showing correct display

Hi,
while this only shows up during ACC testing, it is really an ASG issue. The ASG in question is currently running 8.202 soft release.

The ASG is is showing connected, but the diagnostic screen says failure. The ACC isn't showing any connection.

I changed the shared password to try the function, but the ASGs had not reconnected after the software upgrade to 2.880.

Ian

Parents

0 Hakan Yueksel over 12 years ago
Hi Ian,

could you please compare the shared secrets on both the ACC and the
ASG by doing the following steps:

ASG:

- login per ssh and type following command:

cc get acc

ACC:
- login per ssh and type following commands:

cc get accd

- and also:

psql -U acc -P pager=off -c 'select * from confd_data;'

- in each output the keyword "secret" must point to the same value

Regards, Hakan
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 RFCat_vk_01 over 12 years ago in reply to Hakan Yueksel

Hi Hakan,
I manually updated the shared secret and as I did each ASG connected within seconds.

Ian
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 Hakan Yueksel over 12 years ago in reply to RFCat_vk_01

Hi Ian,

we have just found a little bug on the ASG.

Normally you shouldn't need to manually update the shared secret on
the ASG as this is done automatically by the ACC. Due to the bug the
ASG doesn't use the new secret when a reconnection is done as it has
been the case when you updated your ACC to 2.880.

Regards, Hakan
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 BrucekConvergent over 12 years ago in reply to Hakan Yueksel

Is this going to be fixed in time for the offical V3 GA Release?

CTO, Convergent Information Security Solutions, LLC

https://www.convergesecurity.com

Sophos Platinum Partner

--------------------------------------

Advice given as posted on this forum does not construe a support relationship or other relationship with Convergent Information Security Solutions, LLC or its subsidiaries. Use the advice given at your own risk.
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 RFCat_vk_01 over 12 years ago in reply to BrucekConvergent

Hi Bruce,
the fix needs to put into ASG 8.203 or maybe 8.202 GA.

I don't think it will happen for 8.202 GA, so that leaves 8.203.

Ian
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 BrucekConvergent over 12 years ago in reply to RFCat_vk_01

RFCat, do you work for Astaro? I don't look forward to waiting yet another month before I can move my managed clients to the 8.2xx branch -- we change the PSK on a regular basis for ACC.

CTO, Convergent Information Security Solutions, LLC

https://www.convergesecurity.com

Sophos Platinum Partner

--------------------------------------

Advice given as posted on this forum does not construe a support relationship or other relationship with Convergent Information Security Solutions, LLC or its subsidiaries. Use the advice given at your own risk.
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel

Reply

0 BrucekConvergent over 12 years ago in reply to RFCat_vk_01

RFCat, do you work for Astaro? I don't look forward to waiting yet another month before I can move my managed clients to the 8.2xx branch -- we change the PSK on a regular basis for ACC.

CTO, Convergent Information Security Solutions, LLC

https://www.convergesecurity.com

Sophos Platinum Partner

--------------------------------------

Advice given as posted on this forum does not construe a support relationship or other relationship with Convergent Information Security Solutions, LLC or its subsidiaries. Use the advice given at your own risk.
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel

Children

0 Hakan Yueksel over 12 years ago in reply to BrucekConvergent

Hi Bruce,

the bug is on ASG side. The fix will be available within the next ASG release.

The bug occurs when the acc-agent reconnects to the ACC
since it does not correctly save the changed secret.

Workaround is to manually set the new secret on the ASGs webadmin.

Regards, Hakan
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 BrucekConvergent over 12 years ago in reply to Hakan Yueksel

Hakan, when you say the "next release" ... are we talking about 8.202?

CTO, Convergent Information Security Solutions, LLC

https://www.convergesecurity.com

Sophos Platinum Partner

--------------------------------------

Advice given as posted on this forum does not construe a support relationship or other relationship with Convergent Information Security Solutions, LLC or its subsidiaries. Use the advice given at your own risk.
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 Hakan Yueksel over 12 years ago in reply to BrucekConvergent

8.202 has been soft-released last week. It's also too late to get the patch
into the 8.202 GA-release. So it will be in the next release right after
8.202.
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 BrucekConvergent over 12 years ago in reply to Hakan Yueksel

Ouch... that's too bad.

CTO, Convergent Information Security Solutions, LLC

https://www.convergesecurity.com

Sophos Platinum Partner

--------------------------------------

Advice given as posted on this forum does not construe a support relationship or other relationship with Convergent Information Security Solutions, LLC or its subsidiaries. Use the advice given at your own risk.
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 RFCat_vk_01 over 12 years ago in reply to BrucekConvergent

Hi Bruce,
just to clarify the bug a bit. I won't affect your deployment if you don't restart your ACC and immediately change the shared secret.

The bug only occurs if the shared secret is changed before the ACC has re-established communication with all the ASG's it is monitoring.

If you ACC is on a UPS and the ASG it is working through don't change at the time the shared secret is changed then you should not have an issue with the deployment of ASG 8.2***.

Regards

Ian
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel